Since 29 June 2023, unsolicited commercial calls in Spain are subject to a stricter legal regime. As a general rule, end users have the right not to receive unwanted calls for commercial communication purposes unless they have given prior consent or the call can rely on another valid legal basis under the GDPR.
The AEPD Circular 1/2023 interprets Article 66.1.b) of Law 11/2022, the Spanish General Telecommunications Law, and sets out the criteria that the Spanish Data Protection Agency will apply. This is no longer only a marketing issue: it is a privacy, data protection and compliance obligation.
In this article we will discuss...
What is an unsolicited commercial call?
An unsolicited commercial call is a phone communication made for advertising or commercial purposes without the recipient having requested it. It may involve companies calling directly or companies hiring third parties for telemarketing campaigns.
Outsourcing the campaign does not remove responsibility. If a company hires an agency, call centre or marketing provider, it must ensure that there is a valid legal basis, that exclusion lists are respected and that the provider acts with sufficient safeguards.
The general rule since 2023: consent or another valid legal basis
The rule starts from a simple idea: users have the right not to receive unwanted commercial calls. A company may call only if it has prior consent or can justify another legal basis under Article 6.1 GDPR, such as a real, balanced and documented legitimate interest.
Legitimate interest cannot be assumed automatically. The company must prove a previous relationship, a reasonable expectation by the user and a proper balancing test between the commercial interest and the rights of the person called. It must also provide clear information and allow objection in an easy way.
Robinson List and right to object
Before starting a phone campaign, the company must check whether the person is included in advertising exclusion systems, such as the Robinson List, where applicable. It must also respect any previous objection received directly from the data subject.
Ignoring an objection or calling a person included in an exclusion list may lead to complaints before the AEPD and sanctions. Internal opt-out management must be documented, updated and communicated to all providers involved in the campaign.
The 4,000 euro fine case
The AEPD previously fined a company 4,000 euros for making advertising calls to a person who had objected to the processing of their data and was registered on the Robinson List. The case showed a common issue: the company had acquired or used a database for advertising purposes without properly ensuring the lawfulness of the processing.
The decision reminded companies that the business benefiting from the campaign remains responsible for its advertising, even when part of the service is outsourced. Buying databases or delegating calls without adequate controls can therefore create liability.
Practical obligations for companies using telemarketing
- Identify the legal basis before starting the campaign.
- Check advertising exclusion lists and internal objection records.
- Inform the user of the controller’s identity and the purpose of the call.
- Allow objection in an easy way during the call or through later channels.
- Document the legitimate interest balancing test if that legal basis is used.
- Sign contracts with providers when processors are involved.
- Keep evidence of consent, previous relationship, opt-outs and controls performed.
Risks of buying databases for commercial calls
Buying databases for telephone campaigns is one of the highest-risk practices. The company must be able to prove where the data came from, what information was given to the user, what legal basis allows the communication and whether the person can object easily.
Without traceability, valid consent or a solid legal basis, the campaign may breach the GDPR, the Spanish General Telecommunications Law and Spanish data protection rules.
Frequently asked questions
Are all commercial calls prohibited?
No. The restriction concerns unwanted commercial calls. Calls may be made where there is prior consent or where the company can justify another valid legal basis, always respecting the right to object.
Can I call former customers?
It depends. Legitimate interest may exist in some cases, but it must be assessed case by case: previous relationship, similar products, reasonable expectation, information provided and easy opt-out.
Does the Robinson List apply to all companies?
Companies carrying out commercial campaigns must take advertising exclusion systems into account where applicable and must respect users’ express objections.
What happens if I hire a call centre?
The advertiser remains responsible. It must sign the appropriate contract, provide clear instructions, verify safeguards and ensure that the provider respects opt-outs, objections and exclusion lists.
Conclusion
Unsolicited commercial calls are now a clear risk area for any company operating in Spain. Before calling, businesses should review the legal basis, exclusion lists, provider contracts and available evidence. In telemarketing, lack of control can lead to complaints, fines and loss of trust.